Executive brief
CordysCRM is an open source customer relationship management system that manages customer interactions, workflows, and alerts. Unauthenticated attackers can access other users' workflow events, approval requests, and alerts by exploiting unprotected Server-Sent Event endpoints, or inject fake messages into other users' notification streams. This allows attackers to spy on other users' activities and disrupt their workflow.
Technical details
The SSE /subscribe, /broadcast, and /close endpoints are exposed as public paths by ShiroFilter without requiring authentication, and trust the caller-supplied userId parameter instead of deriving identity from an authenticated session. An attacker can craft requests to read another user's SSE stream, inject SYSTEM_HEARTBEAT messages, or terminate channels. The vulnerability is fixed in version 1.7.2 by removing the /broadcast endpoint and enforcing proper authentication checks.
Affected products
- 1Panel-dev CordysCRM prior to 1.7.2
Timeline
- 2026-09-18: disclosed
- 2026-06-17: patched: Fix merged in version 1.7.2